Horton

Re: Missing NULL check after calling ecpg_strdup

Aleksander Alekseev <aleksander@tigerdata.com>

View thread View on postgr.es
From: Aleksander Alekseev <aleksander@tigerdata.com>
To: pgsql-hackers@lists.postgresql.org
Cc: Evgeniy Gorbanev <gorbanyoves@basealt.ru>
Date: 2025-07-11T16:22:36Z
Lists: pgsql-hackers

Attachments

Hi Evgeniy,

> In case of out_of_memory, the ecpg_strdup function may return NULL.
> Checks should be added in src/interfaces/ecpg/ecpglib/execute.c.
> Patch attached.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

The patch looks correct, but I believe it's incomplete. It misses
several other places where ecpg_strdup() is called without proper
checks. A correct patch would look like the one attached.

While working on it I noticed a potentially problematic strcmp call,
marked with XXX in the patch. I didn't address this issue in v2.

Thoughts?

Commits

  1. ecpg: Improve error detection around ecpg_strdup()

  2. ecpg: Fix NULL pointer dereference during connection lookup